mochi
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches supplemental API documentation from the vendor's domain (https://www.pixazo.ai/models/mochi.md) to resolve parameter details at runtime.\n
- Ingestion points: Remote fetch specified in SKILL.md instructions.\n
- Boundary markers: None defined for the fetched markdown content.\n
- Capability inventory: Network POST requests via curl and requests, and local file writing to ~/.pixazo/api-key.\n
- Sanitization: No explicit validation of the remote documentation content is performed before processing.\n- [EXTERNAL_DOWNLOADS]: The agent is instructed to fetch model reference data from a vendor-controlled URL (https://www.pixazo.ai/models/mochi.md).\n- [COMMAND_EXECUTION]: The skill utilizes local shell commands including curl to interact with the API and chmod to manage credential file permissions (chmod 600).
Audit Metadata